On day two of Pwn2Own Ireland 2026, security researchers collected $232,500 in cash prizes after exploiting 45 unique zero-day vulnerabilities.
The highlight of the day was the flagship Samsung Galaxy S26 being hacked three times KAIST Hacking Labis Kyeongmin Kim, PetoWorksAnd Mobile hacking laboratoryare Dimitrios Valsamaras and Ken Gannon.
Jack Dates from RET2 Systems demonstrated a Sonos Era 300 exploit chain in less than a minute, and HaeJung Yang from the Out of Bounds team received $40,000 for it Hack Dynamo in the AI infrastructure category.
PetoWorks, Yves Bieri from Xint, Kyeongmin Kim, _McCaulay and Doyensec’s Yassine Bengana and Maxence Schmitt Also chopped The Home Assistant Green clever Home Hubwhile Ikotas Labs breached the Oracle Autonomous AI Database Using a seven-chain zero-day exploit.
Before the second day began, Kyeongmin Kim withdrew his attempt in a USB-based attack on the Google Pixel 10.
Trend Micro’s Zero Day Initiative (ZDI) is organizing the competition to identify zero-day vulnerabilities in fully patched devices before attackers exploit them in the wild. Accordingly Pwn2Own rulesAll devices are running the latest firmware versions and participants must compromise the target and demonstrate arbitrary code execution.
After zero-days are exploited and disclosed to Pwn2Own, vendors have 90 days to patch their software before ZDI publicly discloses it.
During the Pwn2Own Ireland 2026 competition, participants Target products in seven categoriesThese include mobile phones (Samsung Galaxy S26 and Google Pixel 10), messaging apps, smart home devices, printers, AI infrastructure, AI coding apps, and a new category where hackers will attempt to exploit healthcare devices.
While Apple’s iPhone 17 was also a potential target and received a maximum reward of $300,000 for a remote hack, no participants signed up for an attempt.
Interrupt laboratories, Ikotas LabsAnd Nguyen Thanh Dat from Viettel Cyber Security also hacked Samsung’s flagship Galaxy S26 on day one, but some of them the beetles exploited were already known to the seller.
VinSOC’s Vu Chi Thanh and Huynh Duc Tin, who topped the leaderboard on day one, won $40,000 a five-zero-day exploit chain The goal is the Oracle Autonomous AI Database, plus another $40,000 to chain seven zero daysto use a Philips Hue Bridge Pro Smart Lighting Hub.
On the third daySecurity researchers will once again attempt to hack several smart home, AI infrastructure and printer devices, as well as the Samsung Galaxy S26 and Google Pixel 10 smartphones.
During the Pwn2Own Ireland 2025 competition, hackers demonstrated 73 zero-day vulnerabilities and earned $1,024,750. The Summoning Team won the competition and raised $187,500 after hacking the Samsung Galaxy S25, Home Assistant Green, QNAP TS-453E NAS, and several Synology devices.
